Which status code represents valid authentication but insufficient authorization?

Which status code represents valid authentication but insufficient authorization?

• A. 400 - Bad Request
• B. 401 - Unauthorized
• C. 403 - Forbidden
• D. 404 - Not Found

Answer: (C)

The scenario tests the difference between authentication and authorization in HTTP responses. When a client has proven who they are (valid authentication) but does not have permission to access the requested resource, the server should respond with a 403 Forbidden. This indicates that access is understood and the user is allowed to be authenticated, but they’re not authorized to perform that action. By comparison, a 401 Unauthorized means credentials are missing or invalid and must be provided or corrected. A 400 Bad Request signals a malformed request, and a 404 Not Found means the resource doesn’t exist. So, the status code for valid authentication but insufficient authorization is 403 Forbidden.

The scenario tests the difference between authentication and authorization in HTTP responses. When a client has proven who they are (valid authentication) but does not have permission to access the requested resource, the server should respond with a 403 Forbidden. This indicates that access is understood and the user is allowed to be authenticated, but they’re not authorized to perform that action. By comparison, a 401 Unauthorized means credentials are missing or invalid and must be provided or corrected. A 400 Bad Request signals a malformed request, and a 404 Not Found means the resource doesn’t exist. So, the status code for valid authentication but insufficient authorization is 403 Forbidden.